On the majority of modern transport aircraft many moving parts are moved by actuators using power transmitted in hydraulic fluid under pressure.
Aerodynamic control surfaces and the mobile parts of landing gears are the main elements moved by hydraulic actuators and their correct operation is vital since any uncontained failure can put the aircraft at risk.
For these safety reasons, aircraft hydraulic systems, comprising hydraulic generators, hydraulic distributors and actuators, are laid out according to architectures that attempt to limit the consequences of possible failures in said systems and in any event to prevent a likely failure from causing consequences that could jeopardize the affected aircraft's integrity.
Many different architectures have been devised and or implemented on aircraft to limit the consequences of hydraulic system component failures.
There are principles common to all known architectures, at least for those used onboard civilian aircraft that must comply with strict certification regulations, consisting of installing several independent hydraulic circuits, two or three circuits in general, each circuit possibly comprising certain components two or several times, for instance two hydraulic pumps (redundancy rules) and, further, to lay out said circuits on board the aircraft such that the risk of a single damage triggering event damaging two or several redundant circuits or components is improbable (segregation rule).
In order to implement these basic hydraulic systems safety principles some hydraulic circuits are fitted with at least two hydraulic pressure generators, hydraulic pumps, driven by separate engines, e.g. a propulsion engine on the left wing of a plane and a propulsion engine on the right wing (or an electric motor, or a wind turbine or an auxiliary power unit)
In this type of hydraulic circuit, it is required that the failure of one generation source in the circuit does not make the circuit unusable thus making the second generation source for this same circuit useless. In the opposite case the pump redundancy would then be apparent and would not meet the stated objective.
A significant risk for a hydraulic circuit whose hydraulic power generation uses a hydraulic pump driven by a propulsion engine of the turbojet or turboshaft turbine type comes from debris that may be thrown during the uncontained failure of a rotating part of said turbine, an event referred to as uncontained engine failure.
Hydraulic pumps mechanically driven by the propulsion engines are of necessity located close to said engines and in general it is not possible to have the hydraulic lines connected to said pumps installed outside the sensitive areas that may be reached by debris caused by uncontained engine failure of an engine.
Should such an event occur, there is a high risk that a hydraulic line will be severely damaged or even severed and that, absent specific measures, the affected hydraulic circuit will lose hydraulic fluid quickly and become unusable.
To avoid the loss of all the hydraulic fluid in the event of a broken line during an uncontained engine failure, an apparatus specific to the engine, e.g. an engine control unit that includes monitoring functions, that analyses engine operating parameters that may allow detection of uncontained engine failure issues a specific alert to signal uncontained failure of the affected engine, said alert being used to control the closure of cut-out valves mounted on the hydraulic lines and causing the hydraulic circuit to be isolated from the uncontained failure area in which a line may have been severed.
One problem with this type of apparatus comes from the fact that most often, the means of detecting an uncontained engine failure cannot issue the corresponding signal before a long period, of the order of 30 seconds, in regards to the hydraulic leak occasioned by a severed pump line.
To activate the cut-out valve or valves that isolate the hydraulic circuit from the pumps driven by the failing engine before all the hydraulic fluid is lost, it is necessary to have a large-capacity fluid reserve tank, a solution that is generally dismissed because of the mass that results from such a solution.
It is also feasible to implement other means of detection e.g. wires to be broken associated with the hydraulic lines that allow rapid detection of a severed line by breaking in case of rupture of the lines.
These solutions however are also not completely satisfactory because of the fragility of the wires to be broken that work, in the case of hydraulic lines close to propulsion engines, in a harsh environment that does not always allow detection of all the possible engine debris trajectories.
In the end, the necessity of taking into consideration the case of uncontained engine failure and damaged hydraulic lines close to the pump or pumps associated to that engine leads to complicated and burdensome hydraulic generation systems architectures, in particular by placing hydraulic circuits entirely outside the uncontained engine failure debris projection areas which in turn imposes the use of pumps driven by means other than the propulsion engines, e.g. electric motors or wind turbines etc.